Podman logs to Splunk HEC
Is there a way to send podman logs to Splunk HEC as docker does? https://docs.docker.com/config/containers/logging/splunk/ Regards Osama
On 9/28/20 11:15, Osama Elswah wrote:
Is there a way to send podman logs to Splunk HEC as docker does? https://docs.docker.com/config/containers/logging/splunk/
Regards Osama
_______________________________________________ Podman mailing list -- podman@lists.podman.io To unsubscribe send an email to podman-leave@lists.podman.io
We don't currently support logging plugins, but would love to have help from the community to implement this. Please open a Github issue on this.
*Quote:* *A twelve-factor app never concerns itself with routing or storage of its output stream.* It should not attempt to write to or manage logfiles. Instead, each running process writes its event stream, unbuffered, to stdout. During local development, the developer will view this stream in the foreground of their terminal to observe the app’s behavior. End of quote https://12factor.net/logs The question is should podman have a plugins mechanism that do something similar to podman logs -f mycnt | send_to_xyz mycnt should we implement jsonl log format (one json per line) https://docs.docker.com/config/containers/logging/json-file/ On Tue, Sep 29, 2020, 9:20 PM Daniel Walsh <dwalsh@redhat.com> wrote:
On 9/28/20 11:15, Osama Elswah wrote:
Is there a way to send podman logs to Splunk HEC as docker does? https://docs.docker.com/config/containers/logging/splunk/
Regards Osama
_______________________________________________ Podman mailing list -- podman@lists.podman.io To unsubscribe send an email to podman-leave@lists.podman.io
We don't currently support logging plugins, but would love to have help from the community to implement this. Please open a Github issue on this. _______________________________________________ Podman mailing list -- podman@lists.podman.io To unsubscribe send an email to podman-leave@lists.podman.io
The question is should podman have a plugins mechanism that do something similar to
podman logs -f mycnt | send_to_xyz mycnt
should we implement jsonl log format (one json per line)
First, can we agree to implement something like https://github.com/cri-o/cri-o/pull/1605 "Stream Log Writer"? Currently, conmon implements a byte-for-byte log stream interpretation. By moving it to where conmon just records what it has read from each pipe won't we avoid multiplying the amount of data written by conmon to disk? Each newline character in the byte stream demarks a log record, where metadata is added to what is written to disk. Once we have that problem solved, then sending that record remotely, or to a file, can be decided by some configuration to conmon, but conmon won't increase the data rate based on the log stream contents. Further, we also need to implement https://github.com/containers/conmon/issues/84, "Provide logging behavior policies applied by conmon to stdout/stderr", so that the SRE can control the max rate of logging from containers, and arguably should be applied to the whole node, and then allowing container writer to determine the behavioral policy of what to do when that rate limit is hit (drop, back-pressure, or just ignore all logs entirely). Thoughts? Perhaps this would be a good GSoC project for somebody?
https://docs.docker.com/config/containers/logging/json-file/
On Tue, Sep 29, 2020, 9:20 PM Daniel Walsh <dwalsh(a)redhat.com> wrote:
participants (4)
-
Daniel Walsh -
Muayyad AlSadi -
Osama Elswah -
peter.portante＠redhat.com